hCaptcha vs reCAPTCHA vs Turnstile: Free Limits (2026)

hCaptcha, Google reCAPTCHA and Cloudflare Turnstile are CAPTCHA services: a widget checks the visitor in the browser and hands your form a token, and your server confirms that token with the vendor before it accepts the submission.

reCAPTCHA vs hCaptcha vs Turnstile: which should you choose?

Choose Turnstile if…

• You want the lowest friction and no cost ceiling: unlimited free challenges, usually nothing to solve.
• You are leaving reCAPTCHA v2 and want a quick swap through its ?compat=recaptcha mode.

Choose reCAPTCHA if…

• You depend on v3-style scores; Turnstile's compatibility mode doesn't cover them.
• Your volume stays under 10,000 assessments a month across your Google Cloud organization, or you accept $8 flat for 10,001–100,000.

Choose hCaptcha if…

• You want the closest drop-in for existing reCAPTCHA v2 code and a US vendor independent of Google.
• Accessibility fallbacks matter: it documents the most (accessibility cookie, optional text challenge).

For a plain contact form, you may not need any of them.

How do hCaptcha, reCAPTCHA and Turnstile compare?

The table covers what decides the choice: the free limit, what you pay after it, what happens to visitor data, what visitors see, and how hard the switch is. Each cell links to the page it came from.

Can hCaptcha be a drop-in replacement for reCAPTCHA?

Yes, for reCAPTCHA v2-style widgets. hCaptcha's switching guide lists four changes: load https://js.hcaptcha.com/1/api.js instead of Google's script, rename the g-recaptcha class to h-captcha, read h-captcha-response instead of g-recaptcha-response, and post it to https://api.hcaptcha.com/siteverify. Its JavaScript methods, such as render(), are API-compatible with reCAPTCHA's, according to the hCaptcha developer guide.

Two catches. You need new site and secret keys from hCaptcha. And if you used reCAPTCHA v3 scores, hCaptcha's scores are Enterprise risk scores that run the other way: 0.0 means no risk and 1.0 a confirmed threat, so flip any threshold you set.

<!-- Before: reCAPTCHA v2 -->
<script src="https://www.google.com/recaptcha/api.js" async defer></script>
<form action="https://splitforms.com/api/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input name="email" type="email" required />
  <div class="g-recaptcha" data-sitekey="YOUR_RECAPTCHA_SITEKEY"></div>
  <button type="submit">Send</button>
</form>

<!-- After: hCaptcha (verify h-captcha-response on your own backend) -->
<script src="https://js.hcaptcha.com/1/api.js" async defer></script>
<form action="https://your-backend.example.com/contact" method="POST">
  <input name="email" type="email" required />
  <div class="h-captcha" data-sitekey="YOUR_HCAPTCHA_SITEKEY"></div>
  <button type="submit">Send</button>
</form>

Turnstile has a similar shortcut. Add ?compat=recaptcha to its script and it answers grecaptcha calls and posts a g-recaptcha-response field, for code written against reCAPTCHA v2 only (Cloudflare's migration guide). Either way, check that whatever receives the form verifies the new token. Note the "after" form posts to your own backend: splitforms verifies reCAPTCHA v2 and Turnstile tokens, not hCaptcha's.

Is hCaptcha free?

Yes. hCaptcha Basic costs $0, according to hCaptcha's pricing page. Pro costs $139 a month billed monthly, or $99 a month billed yearly, includes 100,000 evaluations a month, then charges $0.99 per 1,000; it adds a low-friction passive mode. Enterprise is priced by sales and adds a no-CAPTCHA mode and risk scores.

What are hCaptcha's limits?

hCaptcha gives two answers for the free plan. Its pricing page lists no evaluation cap for Basic, while its plans page says "Free up to 10,000 requests per month". Plan around 10,000 a month and ask hCaptcha before you expect more. Pro includes 100,000 evaluations a month and bills $0.99 per 1,000 after that. For what each plan includes and costs, see hCaptcha pricing and free plan limits.

One smaller limit from the developer guide: free accounts can rotate their secret key once per day.

How much do reCAPTCHA and Turnstile cost past the free tier?

reCAPTCHA, now part of Google Cloud Fraud Defense, gives each organization 10,000 free assessments per calendar month across all its sites and keys. Without billing, requests then fail with a 429 error until the 1st of the next month; with billing, 10,001–100,000 costs a flat $8 and each 1,000 after that costs $1 (tier comparison, billing docs).

Turnstile's free plan has unlimited challenges, with up to 20 widgets and 10 hostnames per widget. Enterprise lifts that to unlimited widgets and up to 200 hostnames per widget (Turnstile plans).

For one contact form, 10,000 reCAPTCHA assessments a month is plenty. The catch is that the quota is shared across your whole Google Cloud organization, so an agency, or a team that also protects logins and checkouts, can run out mid-month.

Which is best for privacy?

Turnstile and hCaptcha make the narrowest data claims, so pick one of them if privacy decides it. All three still process visitor signals as a third party:

• Turnstile: Cloudflare says Turnstile does not access, store or transmit form entries or other page inputs (Turnstile overview).
• hCaptcha: Intuition Machines, a US company independent of Google, says it minimizes collection and keeps no long-term data about end users (hCaptcha privacy policy).
• reCAPTCHA: since April 2, 2026, Google acts as your data processor and you are the controller; the badge no longer links Google's Privacy Policy and Terms. It still sets a necessary _GRECAPTCHA cookie and sends signals to Google (reCAPTCHA FAQ).

Whichever you use, name it in your privacy policy; under GDPR you are the controller either way. This isn't legal advice. The only setup that sends no visitor data to anyone is a server-side check with no CAPTCHA at all, covered below.

Which is easiest for visitors and most accessible?

Turnstile usually shows nothing: its managed, non-interactive and invisible modes decide on their own whether to show a checkbox. reCAPTCHA v3 shows nothing either, but returns a score your server has to act on; reCAPTCHA v2 is the "I'm not a robot" checkbox or an invisible badge (reCAPTCHA versions). hCaptcha Basic shows a checkbox and sometimes a visual challenge; its passive mode is a Pro feature.

When a challenge does appear, hCaptcha documents the most fallbacks: an accessibility cookie for registered users and an optional text-based challenge (hCaptcha accessibility). None of the three vendors publishes a bot-blocking rate you can compare like for like, so choose on friction, privacy and cost, then measure your own spam.

Do you need a CAPTCHA at all?

Often not, for a contact form. Plenty of form spam comes from simple scripts that fill every field and post instantly. A hidden honeypot field (splitforms uses botcheck) and a time-trap that drops submissions sent less than 2 seconds after the page loaded catch those without asking a person to do anything.

Generate the markup with the free honeypot field generator, and read honeypot vs reCAPTCHA for when each layer is enough. Add a CAPTCHA once you've measured spam that gets past those checks; adding Turnstile to an HTML form takes one script tag and one server call.

How we checked these facts

Related guides

• Choosing for a contact form specifically? See the best CAPTCHA for contact forms.
• Leaving reCAPTCHA and want more than these three? Compare 10 reCAPTCHA alternatives, including open-source ALTCHA and Friendly Captcha.
• Setting up Turnstile: Cloudflare Turnstile on an HTML form.
• No-CAPTCHA route: honeypot vs reCAPTCHA and the honeypot field generator.
• Everything splitforms checks on the server: spam protection.

FAQ